Phone Mess

• Die, robocalls, die: A how-to guide to stop spammers and exact revenge: WashingtonPost Apr 2019
• AT&T and Comcast today said they have completed a successful cross-network test of a new Caller ID authentication system: Arstechnica: Mar 2019
• Britain’s spy agency delivers a scathing assessment of the security risks posed by Huawei to the country’s telecom networks: WashingtonPost Mar 2019
• A National Treasure: John Oliver fights robocalls... by robocalling Ajit Pai and the FCC: Arstechnica, Mar 2019
• Criminals Are Tapping into the Phone Network Backbone to Empty Bank Accounts: Motherboard, Feb 2019
• How to Verify Phone Numbers with PHP, Symfony and Twilio: Chris Lush, Nov 2017
• Anatomy of a scam – how phone frauds harvest millions from us: Naket Security, Jun 2017
• THE CRITICAL HOLE AT THE HEART OF OUR CELL PHONE NETWORKS: Wired, April 2016

Update: Undersea Cables

• Submarine cable map.  The default goto map
• Times has a nice infographic thing on the oceanic fiber links   
• Big Tech (google/MS/FB/etc) are buying up oceanic fiber links   
• (oldpost) AS Peering 
• (oldpost) Undersea Cable Map   

Coolest thing in desktop computing I've seen in a long while

LunaDisplay: No idea why Apple hasn't either bought these guys out, or just reproduced this on their own.  I have a friend who has this and it is soooo cool!  He uses his ipad as a second monitor to his laptop.  The total solution is incredibly portable, and he gets to have an ipad rather then just a dumb 2nd monitor.

Hypertext Transfer Protocol (HTTP) over QUIC will officially become HTTP/3

Daniel Stenberg's writes that HTTP/3 will be defined soon to incorporate QUIC.

Robert Graham explains more about QUIC, and Googles QUIC project.

- IETF#103 Meeting (Nov,2018) to discuss the new name http/3
- HTTP/3: From root to tip 

Cisco's new Licensing and why I'm leaving Cisco.

Cisco's new "SMART Licensing" is anything but that.  It needs each switch to call home every month.  If it fails three months in a row, the switch will shut down.  (hows that for "never fail networking"!  This does a couple of things that are inexcusable.

(1) It creates a major threat to the stability of your network.  It becomes the most critical item to monitor in your network (you need to make sure that it's calling home successfully or you go down hard!).

(2) It forces you to do the one thing you NEVER want to do in a production system: allow your management network direct internet access.

(3) It breaks the value proposition you had with cisco when you originally purchased your gear.  I paid an extra penny for their poor TAC support because I knew that I could recoup some of that cost when I was done with the gear by reselling it.  Now when I'm done with a cisco switch, it becomes nothing better then a boat anchor.

BGP Hijacking

	On Nov 12th 2018, everyone lost their shit because Google traffic was being rerouted to Putin.   This is not new news.   Back in DefCon-16 (2013)  Anton Kapela & Alex Pilosov made a great presentation "Stealing The Internet - A Routed, Wide-area, Man in the Middle Attack". Kim Zetter at Wried even did a good writeup on this for the mainstream.

Winner of the Cool Network Map Award!

Gotta hand it to the folks over at HE.  I stumbled across their network map, and it's SO stocked full of eye candy!  Other companies maps might do a better job at getting the information you want to you, but this think definitely wins the WOPR Blinkenlights award!

TCP Sucks

WAN Accelerators have been around for a while ( see Peribit ) to try and deal with how TCP blows over larger distances (latency).  The real goal is to bring that tech directly to the computers and rejigger the way computers talk to each other.  Looks like that is happening:

•  HTTP/3 (HTTP/QUIC) : Looks like IETF is making this formal.  

TLS Security

(not a bad form of modern security, right?  ... except for the not being able to hit anybody issue)

• João Poupino has a great writeup in probe.ly on "How to deploy modern TLS in 2018?" which covers what it is, it's background and history of TLS as well as recommendations for you to use.  Good for explaining to managers, as well as simply reading for yourself.  
• Sergiu Gatlan points out that TLS 1.0 / 1.1 Deprecated in Chrome, Safari, Firefox, and Edge Starting 2020 (IETF is expected to formally deprecate TLS 1.0 / 1.1 in 2018) 

You worry about this in your data center?!?!?

My favorite line in a legal agreement for a data center:

"The toilet rooms, urinals, wash bowls and other apparatus shall not be used for any purpose other than that for which they were constructed, and no foreign substance of any kind whatsoever shall be thrown therein."

NSA pwned DE-CIX

The Financial Times's reporter Chris Bryant is claiming that the report by Der Spiegel's Laura Poitras, Marcel Rosenbach, Fidelius Schmid and Holger Stark, points out that the worlds largest exchange DE-CIX, has somehow been "working" with the NSA.  He claims that the NSA has been able to "obtained around 500m communications metadata a month from Germany".

Can't imagine that they are spanning/tapping any ports as the size of the network, number of peers and the number of data centers potentially included would make this a bit on the difficult side, They must be getting some flow data or something... (??)

On a side note, Slashdot notes MITs Immersion Project, that "constructs a map of your associations. Without opening a single message, it gives a clear view of who you connect with. It's a glimpse of some of what the NSA PRISM can do."

More Coffee Shop Hackary!

I love my N900!  There is a great pen tester that can run either on it or a plug-pc running Ubuntu.   Its called pwnieexpress! Both the plug-pc and (obviously the n900) will let you pen-test  wired, wireless, and 3G networks.

Media Consolidation

Frugal Dad has a great infographic on how bad things have gotten in the media world.

Note the following sites that are attempting to fix this:

• Electronic Frontier Foundation
• RootStrikers
  
• FreePress.net

War Flying

geek.com has a writeup about Mike Tassey and Richard Perkins who built a very cool remote RC plane that scans the airwaves below it, tracks wifi nets, and pen tests them. It runs the full backtrack suite on the plane, and can be remotely managed, but it can also do everything (fly and sniff) on its own.

Undersea Cable Map

As pointed out in TechCentral, Greg Mahlknecht created a free online ocean cable map showing who owns the cables, their stats, and what they link. akg-random also points out an old undersea cable map from 1901!

Also note TeleGeography's Submarine Cable Map (more underwater net/network diagrams)

Akamai 2011 Q1 Report

Akamai's state of the internet is out, and it's an interesting read. Gizmag has a writeup of the details, including notes about increasing access speeds, more mobile users and attack stats.

Kevin Mitnick shows how easy it is to hack a phone

cnet security has an article/interview with Kevin Mitnick about how easy it is to listen/hack into to others voicemails. (use asterisk, dial up your cell# and in caller id, say your coming from your cell#)

VoIP != Secure

Cisco was concerned that Vomit was too difficult to run, so they made it a bit simpler to hack the phone system assuming that you deploy it with the out of the box configs. With IT shops known for liking their "IT Budget Tight and My Developers Stupid", this can only be a good thing!

No Secrets

On the Media, a radio show produced by WNYC, had a good piece on privacy titled "Your Tweets May Be Betraying You". They pointed out the governments overzealous warrantless wiretapping and how this has affected the Telco’s, how corporations are tracking us so heavily so as to make the government appear disinterested in us, and most interestingly, how we now are volunteering so much information that it makes this entire topic mute.

As an example of how much information is publicly available, they pointed out the script Creepy, which “allows you to gather geolocation related information about users from social networking platforms and image hosting services.”

Where's a DC?

Datacenter Map is a site that lists the physical locations of "all" the DC's and their stats. Does a fairly good job.